???????????????!?????????????????

???????????

2024????12?18??????????????,???????????????????CNCERT?(

????????????

(????)?

???Exchange???2?Exchange???,?,??,?????

(?????????????)?

??,??????2?,?,????????????????,??????????????/owa/auth/xxx/xx.aspx??????????????/owa/auth/xxx/yy.aspx,????????????????,?????????,??????????????

(?)????30???????

?,?,??????????????,????SSH?SMB??30??????????????????????????????;?,?????????????????????????????????????????????????????????????,????????????websocket+SSH???????,??????,?WeChatxxxxxxxx.exe?????2??PIPE??????????,????????????????????????????

????????????????????????????????

(?????????)????

????????????,?????????????????????????,?????????,????,??????????????,??

(?)??????

????????????????3?,?????????????,2023?5???????????????????2??????????,?(95.179.XX.XX)??????????,??,????????,????????????????,??????????????????“????????????????????????”?“??????????”?“??”?“??????????????????????(???????????????????+?)”?“?IP?”?“??????”???????????

(???????????????)?????????

?????????????,??????????????????????????,2023?7?26??????????????????????,??(65.21.XX.XX)????,?,?,?????????????????????????????????,???????????????????1.03GB???????????????????????,?????“???????????????”?“tip4XXXXXXXX.php”?

(?)????????????????????

??,???????????,???????????????????????????,?????????????????SSH?,?????????????????????,??

???????????????????

(?)????

??????,?????????22?????????????8????,?10????????????20??????????????,?,????????????????????????????

(??????????????????)????????????

2023?5????????2023???????????10?????,??30?,??IP???????????????????????,??

(???)?

????????????????????????2?????PIPE????????????????????????????“c:\windows\system32\”????????????????,??.net?,????,?KB,?????????????TLS??????????????????????????????????????,??https?,?websocket+SSH???????????,?????????????????

????????IP?????????????????

?

2024??????????12?????????????????18??????????????,??????CNCERT???????????????(

??????????????????????

(???)?????

2024????????8??????????????19?????????????,???????????????????????,?????????/??????2024??8??????????????21????,?????/????????

(?????????????)??

2024????????8???????21???????12???????,????????????,???????,???????,????????/xxx/xxxx?flag=syn_user_policy???????????,????????/xxx/xxxStats?

(???????????)????????

2024????????????????????11???????????????6??????????????2024??????11??????8?2024????????????11????????????????????????16???????????????,???????????????????????????276??????????????????????????????????????????????????

????????????????

(??????????????)?

?IP?,????????????????????????????,??????????????,??????????????????????????,???????

(??????????)???????????

2024?11???????????????????6?11?????16?????????,??????????????3???????????????????IP??,?????????????????,???????????,???,?????,????????????????????????????????4.98GB?

????????????????

(?????)????

?,??????????????????22?8??????????????,?10?????20???,??,?????

(?)?????????????????

????5???????????????IP?,?????????????,????????????????

(????)??????????????????????????????????

????,??????,??????

?????,??????,???????????????????????

(??????)??????????

?,?,??????????,???276??????,????????????,??????????????????????????????????

????????????????IP?

??????:?????